@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/frontend/src/lib/analysis/investigation-guide.js

@@ -1,10 +1,10 @@
 import { normalizeDomain } from "./case-model.js";
 import { parse } from 'tldts';
 export const INVESTIGATION_GUIDE_SCHEMA = 'whoisleuth.investigation-recipe';
-export const INVESTIGATION_GUIDE_VERSION = 4;
+export const INVESTIGATION_GUIDE_VERSION = 5;
 export const INVESTIGATION_GUIDE_LEGACY_VERSION = 1;
-export const INVESTIGATION_GUIDE_EXPORT_VERSION = 3;
-export const INVESTIGATION_GUIDE_SUPPORTED_VERSIONS = [2, 3, INVESTIGATION_GUIDE_VERSION];
+export const INVESTIGATION_GUIDE_EXPORT_VERSION = 4;
+export const INVESTIGATION_GUIDE_SUPPORTED_VERSIONS = [2, 3, 4, INVESTIGATION_GUIDE_VERSION];
 export const INVESTIGATION_GUIDE_EXPORT_SCHEMA = 'whoisleuth.investigation-recipe-summary';
 export const MAX_INVESTIGATION_GUIDE_DOMAIN_LENGTH = 253;
 export const MAX_INVESTIGATION_GUIDE_REVIEW_DOMAINS = 25;
@@ -16,6 +16,7 @@ const CONTROL_RE = /[\x00-\x1f\x7f]/u;
 const SAFE_TEMPLATE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
 const GUIDE_STATUSES = new Set(['active', 'paused']);
 const GUIDE_OUTCOMES = new Set(['pending', 'complete', 'partial', 'skipped']);
+const PRE_RESPONSE_RECIPE_IDS = new Set(['brand_sweep', 'infrastructure_pivot', 'new_domain_triage']);
 function stage(id, workspace, label, detail, expectedEvidence, requestImpact, prerequisite, completionCriteria, instructions, requiresApproval) {
     return Object.freeze({
         id,
@@ -91,6 +92,39 @@ export const INVESTIGATION_RECIPES = Object.freeze([
             stage('monitor', 'monitor', 'Record disposition', 'Review the bounded domain set carried from Bulk and create or update only the cases that need an analyst decision or follow-up plan.', 'A bounded review queue plus case records with dispositions, notes, evidence history, and optional monitoring intent.', 'Local case editing makes no request. Rescans and hosted-monitor changes remain separate explicit actions.', 'Review source provenance, limitations, and any scoring explanation before deciding.', 'The analyst records the required dispositions or explicitly skips retention; the recipe never decides automatically.', ['Review the domains carried from Bulk and open only the cases that need retention.', 'Record a disposition and any concise evidence-based follow-up for each retained case.', 'Mark the step reviewed when the retained cases reflect your decision.'], false),
         ]),
     }),
+    Object.freeze({
+        id: 'credential_impersonation_response',
+        label: 'Credential impersonation response',
+        summary: 'Review observed impersonation evidence, confirm the affected brand boundary, and prepare a local response packet from explicitly recorded routes.',
+        targetLabel: 'Domain under review',
+        stages: Object.freeze([
+            stage('lookup', 'lookup', 'Review impersonation evidence', 'Collect separately attributed deep evidence for the domain without treating visual or naming similarity as attribution.', 'Current registry, DNS, certificate, HTTP, page-identity, and source-health observations where supported.', 'Deep Lookup can contact several public services within explicit deadlines and response caps.', 'Confirm the target is in scope and do not enter a credential-bearing URL or secret.', 'Observed facts and missing sources are reviewed without making an ownership, intent, or harm conclusion.', ['Run the pre-filled Lookup in Deep mode.', 'Review exact page, redirect, certificate, and registration observations with their source states.', 'Create or update a Case only when the retained observations need reviewed follow-up.'], true),
+            stage('brands', 'brands', 'Confirm affected brand boundary', 'Review the saved Brand Profile that defines official and allowlisted references; do not infer an association from similarity.', 'An analyst-selected Brand Profile boundary, or an explicit decision to continue without one.', 'Local-only. Opening Brands makes no analysis request.', 'Know which saved profile, if any, is relevant to the affected party.', 'The relevant profile boundary is reviewed, or the stage is marked partial or skipped without creating an association.', ['Open the saved Brand Profiles list.', 'Review the official references and allowlists for the affected party.', 'Return to the guide without adding a profile association unless you deliberately selected one in Monitor.'], false),
+            stage('monitor', 'monitor', 'Prepare reviewed response', 'Open the Case response workspace, record only analyst-selected published recipient routes, and review packet preflight.', 'A Case action with recipient provenance and limitations plus an optional local draft packet that remains unsubmitted.', 'Local Case edits and packet generation make no request. WHOISleuth never sends the packet.', 'Retain supporting facts and reasoning before recording an external route; confirm the route manually.', 'The reviewed action and packet preflight are recorded, or the stage is partial or skipped without implying submission.', ['Open or create the pre-filled Case, then review its evidence and reasoning.', 'Record an analyst-selected published route with its source and limitations; do not claim it is reachable.', 'Open response preflight and prepare a local draft only if its required facts are complete.'], false),
+        ]),
+    }),
+    Object.freeze({
+        id: 'mail_abuse_response',
+        label: 'Mail abuse response',
+        summary: 'Review official mail posture and observed domain evidence before preparing a source-qualified, unsent response packet.',
+        targetLabel: 'Domain under review',
+        stages: Object.freeze([
+            stage('brands', 'brands', 'Review official mail posture', 'Review the affected Brand Profile and retained mail posture without treating a missing control as proof of abuse.', 'Analyst-selected official-domain, mail, and Brand Profile context with explicit availability states.', 'Local-only unless the analyst separately starts a Brand posture refresh.', 'Identify the affected profile and distinguish official infrastructure from the domain under review.', 'Relevant retained posture is reviewed, or unavailable context is marked partial rather than absent.', ['Open the saved Brand Profiles list.', 'Review official MX, SPF, DMARC, and approved-domain context where retained.', 'Do not refresh or change a profile unless that separate action is necessary and approved.'], false),
+            stage('lookup', 'lookup', 'Review domain and mail evidence', 'Collect current deep evidence for the domain and keep DNS, mail, registration, and page observations separately attributed.', 'Authority-aware availability plus bounded DNS, mail, TLS, HTTP, and page observations where supported.', 'Deep Lookup can contact several public services within explicit deadlines and response caps.', 'Confirm the domain is in scope; email content and mailbox data are outside this workflow.', 'Current observations and source failures are reviewed without claiming message origin, sender control, or maliciousness.', ['Run the pre-filled Lookup in Deep mode.', 'Review MX, SPF, DMARC, registration, certificate, HTTP, and page source states.', 'Retain only the evidence needed for a reviewed Case.'], true),
+            stage('monitor', 'monitor', 'Prepare mail-abuse response', 'Record a reviewed recipient route and use Case packet preflight without sending or claiming delivery.', 'A bounded Case action and optional local response draft with exact recipient provenance and limitations.', 'Local Case edits and packet generation make no request. WHOISleuth never sends the packet.', 'Confirm the intended recipient and retain the observed facts and limitations that support review.', 'The current action state and packet preflight are recorded, or the stage remains partial without a delivery conclusion.', ['Open or create the pre-filled Case and review its retained evidence.', 'Record only a deliberately selected published route, its source, and known limitations.', 'Use the response preflight to prepare a local draft; submission remains a separate manual action recorded later.'], false),
+        ]),
+    }),
+    Object.freeze({
+        id: 'domain_control_change_response',
+        label: 'Domain-control change response',
+        summary: 'Review retained control posture and current authority-aware evidence before documenting a bounded internal or provider response.',
+        targetLabel: 'Official domain',
+        stages: Object.freeze([
+            stage('brands', 'brands', 'Review retained control posture', 'Review the saved domain-control passport, posture matrix, and source limitations before interpreting a change.', 'Retained official-domain control observations with separately attributed registry, DNS, certificate, mail, and web states.', 'Local-only unless the analyst separately starts a posture refresh.', 'Confirm the domain belongs to the reviewed Brand Profile; a saved association is analyst-selected, not inferred.', 'The retained baseline and its completeness are understood, or the stage is partial when required context is unavailable.', ['Open the relevant saved Brand Profile.', 'Review the domain-control passport, portfolio matrix, and observation times.', 'Identify which source actually supports the suspected change and preserve unavailable states.'], false),
+            stage('lookup', 'lookup', 'Confirm current domain evidence', 'Collect a deliberate deep Lookup so current authority-aware evidence remains distinct from the retained baseline.', 'Current registry, registrar, DNS, certificate, HTTP, and page observations with explicit source health.', 'Deep Lookup can contact several public services within explicit deadlines and response caps.', 'Confirm a fresh collection is necessary and review its request implications.', 'The current result is reviewed against the retained baseline without converting incomplete evidence into removal or compromise.', ['Run the pre-filled Lookup in Deep mode.', 'Compare current observations with the retained control evidence source by source.', 'Record only facts and limitations that need a Case response.'], true),
+            stage('monitor', 'monitor', 'Document control-change response', 'Record an internal or provider action and review an optional response packet without automatic enforcement or submission.', 'A bounded Case action, due or follow-up dates, recipient provenance when external, and an optional unsubmitted packet.', 'Local Case edits and packet generation make no request. WHOISleuth never changes DNS, registrar, hosting, mail, or defensive systems.', 'Document supporting evidence and confirm any recipient route or internal owner manually.', 'The reviewed action state is recorded, or the stage is partial without a compromise, delivery, or remediation claim.', ['Open or create the pre-filled Case and retain the relevant comparison facts.', 'Record the internal owner or analyst-selected provider route, source, limitations, and follow-up dates.', 'Review packet preflight when a draft is useful; record submission or resolution only after it actually occurs.'], false),
+        ]),
+    }),
 ]);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
@@ -239,10 +273,15 @@ export function investigationGuideHref(stageId, domain, recipeId = 'new_domain_t
         return `/discover?q=${encodeURIComponent(registrableGuideDomain(normalized))}#discovery-seed`;
     if (stageDefinition.workspace === 'bulk')
         return `/bulk?investigation=${encodeURIComponent(normalized)}#domains`;
-    if (stageDefinition.workspace === 'monitor')
-        return `/monitor?view=cases&investigation=1&domain=${encodeURIComponent(workingDomain)}#case-review-queue`;
-    if (stageDefinition.workspace === 'brands')
-        return `/brands?new=1&domain=${encodeURIComponent(normalized)}#official-domains`;
+    if (stageDefinition.workspace === 'monitor') {
+        const response = typeof recipeId === 'string' && recipeId.endsWith('_response') ? '&response=1' : '';
+        return `/monitor?view=cases&investigation=1${response}&domain=${encodeURIComponent(workingDomain)}#case-review-queue`;
+    }
+    if (stageDefinition.workspace === 'brands') {
+        return typeof recipeId === 'string' && recipeId.endsWith('_response')
+            ? '/brands'
+            : `/brands?new=1&domain=${encodeURIComponent(normalized)}#official-domains`;
+    }
     return stageDefinition.path;
 }
 export function investigationGuideApprovedHref(guide, stageId) {
@@ -324,9 +363,10 @@ export function parseInvestigationGuide(value) {
     const domain = normalizeInvestigationGuideDomain(input.domain);
     const createdAt = timestamp(input.createdAt);
     const updatedAt = timestamp(input.updatedAt);
-    if (!recipe || !domain || !createdAt || !updatedAt)
+    if (!recipe || !domain || !createdAt || !updatedAt
+        || (input.version !== INVESTIGATION_GUIDE_VERSION && !PRE_RESPONSE_RECIPE_IDS.has(recipe.id)))
         return null;
-    const supportsTemplate = input.version === 3 || input.version === INVESTIGATION_GUIDE_VERSION;
+    const supportsTemplate = input.version === 3 || input.version === 4 || input.version === INVESTIGATION_GUIDE_VERSION;
     const template = supportsTemplate && input.template !== null && input.template !== undefined
         ? normalizeInvestigationGuideTemplateSnapshot(input.template, recipe.id)
         : null;
@@ -361,7 +401,9 @@ export function parseInvestigationGuide(value) {
                 outcome: guideOutcome(item?.outcome),
                 approvedAt: nullableTimestamp(item?.approvedAt),
                 openedAt: nullableTimestamp(item?.openedAt),
-                reviewNote: input.version === INVESTIGATION_GUIDE_VERSION ? boundedReviewNote(item?.reviewNote) : null,
+                reviewNote: input.version === 4 || input.version === INVESTIGATION_GUIDE_VERSION
+                    ? boundedReviewNote(item?.reviewNote)
+                    : null,
                 updatedAt: timestamp(item?.updatedAt) || updatedAt,
             };
         }),

package/frontend/src/lib/analysis/investigation-template-model.js

@@ -1,10 +1,12 @@
 import { INVESTIGATION_RECIPES, normalizeInvestigationGuideTemplateSnapshot, } from "./investigation-guide.js";
 export const INVESTIGATION_TEMPLATE_SCHEMA = 'whoisleuth.investigation-templates';
-export const INVESTIGATION_TEMPLATE_VERSION = 1;
+export const INVESTIGATION_TEMPLATE_VERSION = 2;
+export const INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS = [1, INVESTIGATION_TEMPLATE_VERSION];
 export const MAX_INVESTIGATION_TEMPLATES = 20;
 export const MAX_INVESTIGATION_TEMPLATE_STORE_BYTES = 256 * 1024;
 export const MAX_INVESTIGATION_TEMPLATE_IMPORT_BYTES = 384 * 1024;
 const CONTROL_RE = /[\x00-\x1f\x7f]/u;
+const LEGACY_RECIPE_IDS = new Set(['brand_sweep', 'infrastructure_pivot', 'new_domain_triage']);
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
 }
@@ -17,12 +19,12 @@ function timestamp(value) {
 function byteLength(value) {
     return new TextEncoder().encode(value).byteLength;
 }
-function template(raw) {
+function template(raw, sourceVersion = INVESTIGATION_TEMPLATE_VERSION) {
     const value = record(raw);
     const snapshot = normalizeInvestigationGuideTemplateSnapshot(value);
     const createdAt = timestamp(value?.createdAt);
     const updatedAt = timestamp(value?.updatedAt);
-    return snapshot && createdAt && updatedAt
+    return snapshot && createdAt && updatedAt && (sourceVersion !== 1 || LEGACY_RECIPE_IDS.has(snapshot.recipeId))
         ? { ...snapshot, createdAt, updatedAt }
         : null;
 }
@@ -35,11 +37,12 @@ export function normalizeInvestigationTemplateStore(raw) {
         && Number(value.version) > INVESTIGATION_TEMPLATE_VERSION) {
         throw new Error('This investigation-template collection uses a newer schema and cannot be read safely.');
     }
+    const sourceVersion = Array.isArray(raw) ? INVESTIGATION_TEMPLATE_VERSION : Number(value?.version) || INVESTIGATION_TEMPLATE_VERSION;
     const source = Array.isArray(raw) ? raw : Array.isArray(value?.templates) ? value.templates : [];
     const templates = [];
     const seen = new Set();
     for (const candidate of source.slice(0, MAX_INVESTIGATION_TEMPLATES * 2)) {
-        const normalized = template(candidate);
+        const normalized = template(candidate, sourceVersion);
         if (!normalized || seen.has(normalized.id))
             continue;
         seen.add(normalized.id);
@@ -115,8 +118,8 @@ function strictImport(raw) {
     if (Number(value.version) > INVESTIGATION_TEMPLATE_VERSION) {
         throw new Error('This investigation-template export uses a newer schema and cannot be imported safely.');
     }
-    if (value.version !== INVESTIGATION_TEMPLATE_VERSION) {
-        throw new Error(`Expected investigation-template schema ${INVESTIGATION_TEMPLATE_VERSION}.`);
+    if (!INVESTIGATION_TEMPLATE_SUPPORTED_VERSIONS.includes(Number(value.version))) {
+        throw new Error(`Expected investigation-template schema 1 or ${INVESTIGATION_TEMPLATE_VERSION}.`);
     }
     return normalizeInvestigationTemplateStore(value).templates;
 }

package/frontend/src/lib/analysis/lookup-claim-passport.js

@@ -0,0 +1,236 @@
+import { LOOKUP_CLAIM_READINESS_VERSION, LOOKUP_CLAIM_IDS, LOOKUP_CLAIM_REQUIREMENT_IDS, } from "./lookup-claim-readiness.js";
+import { SORTED_JSON_V2, sha256ArtifactDigestV2, } from "./artifact-integrity.js";
+export const LOOKUP_CLAIM_PASSPORT_SCHEMA = 'whoisleuth.lookup-claim-passport';
+export const LOOKUP_CLAIM_PASSPORT_VERSION = 1;
+export const MAX_LOOKUP_CLAIM_PASSPORT_BYTES = 64 * 1024;
+export const MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS = 16;
+export const MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS = 16;
+export const LOOKUP_CLAIM_PASSPORT_TARGET_TYPES = ['domain', 'ipv4', 'ipv6', 'asn'];
+const SOURCE_STATES = new Set([
+    'complete',
+    'not_found',
+    'partial',
+    'skipped',
+    'unavailable',
+    'unknown',
+    'unsupported',
+]);
+const CLAIM_STATES = new Set(['ready', 'limited', 'not_ready']);
+const REQUIREMENT_IDS = new Set(LOOKUP_CLAIM_REQUIREMENT_IDS);
+const CLAIM_IDS = new Set(LOOKUP_CLAIM_IDS);
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/gu;
+const HAS_CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/u;
+const DOMAIN_RE = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
+const SEMVER_RE = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
+function text(value, maximum) {
+    return typeof value === 'string'
+        ? value.replace(CONTROL_CHARACTERS, ' ').replace(/\s+/gu, ' ').trim().slice(0, maximum)
+        : '';
+}
+function exactText(value, maximum) {
+    if (typeof value !== 'string' || value.length > maximum || HAS_CONTROL_CHARACTERS.test(value))
+        return '';
+    return value.trim();
+}
+function timestamp(value) {
+    if (typeof value !== 'string')
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+function uniqueText(values, maximum = MAX_LOOKUP_CLAIM_PASSPORT_LIMITATIONS) {
+    const output = [];
+    const seen = new Set();
+    for (const value of values.slice(0, maximum * 2)) {
+        const normalized = text(value, 400);
+        if (!normalized || seen.has(normalized))
+            continue;
+        output.push(normalized);
+        seen.add(normalized);
+        if (output.length >= maximum)
+            break;
+    }
+    return output;
+}
+function targetType(value) {
+    if (typeof value !== 'string' || !LOOKUP_CLAIM_PASSPORT_TARGET_TYPES.includes(value)) {
+        throw new TypeError('A supported Lookup target type is required for a claim passport.');
+    }
+    return value;
+}
+function domainTarget(value) {
+    const raw = exactText(value, 253).toLowerCase().replace(/\.$/u, '');
+    if (!raw || /[/\\?#@]/u.test(raw))
+        throw new TypeError('A canonical domain is required for a claim passport.');
+    let normalized = '';
+    try {
+        normalized = new URL(`http://${raw}`).hostname.toLowerCase().replace(/\.$/u, '');
+    }
+    catch { /* fail below */ }
+    if (!DOMAIN_RE.test(normalized))
+        throw new TypeError('A canonical domain is required for a claim passport.');
+    return normalized;
+}
+function ipv4Target(value) {
+    const raw = exactText(value, 64);
+    const parts = raw.split('.');
+    if (parts.length !== 4 || parts.some((part) => !/^\d{1,3}$/u.test(part) || Number(part) > 255 || String(Number(part)) !== part)) {
+        throw new TypeError('A canonical IPv4 address is required for a claim passport.');
+    }
+    return raw;
+}
+function ipv6Target(value) {
+    const raw = exactText(value, 64).toLowerCase();
+    if (!raw || /[\[\]%/?#@]/u.test(raw))
+        throw new TypeError('A canonical IPv6 address is required for a claim passport.');
+    try {
+        const hostname = new URL(`http://[${raw}]/`).hostname;
+        const normalized = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+        if (!normalized.includes(':'))
+            throw new TypeError();
+        return normalized;
+    }
+    catch {
+        throw new TypeError('A canonical IPv6 address is required for a claim passport.');
+    }
+}
+function asnTarget(value) {
+    const raw = exactText(value, 32).toUpperCase().replace(/^AS/u, '');
+    if (!/^\d{1,10}$/u.test(raw) || Number(raw) < 1 || Number(raw) > 4_294_967_295) {
+        throw new TypeError('A canonical ASN is required for a claim passport.');
+    }
+    return `AS${Number(raw)}`;
+}
+function targetValue(type, value) {
+    if (type === 'domain')
+        return domainTarget(value);
+    if (type === 'ipv4')
+        return ipv4Target(value);
+    if (type === 'ipv6')
+        return ipv6Target(value);
+    return asnTarget(value);
+}
+function requirementId(value) {
+    if (typeof value !== 'string' || !REQUIREMENT_IDS.has(value)) {
+        throw new TypeError('The selected claim contains an unsupported evidence requirement.');
+    }
+    return value;
+}
+export async function buildLookupClaimPassport(input) {
+    if (input.readiness.version !== LOOKUP_CLAIM_READINESS_VERSION) {
+        throw new TypeError('The claim-readiness contract is not supported for passport export.');
+    }
+    if (input.readiness.entries.length > LOOKUP_CLAIM_IDS.length) {
+        throw new TypeError('The claim-readiness contract contains too many entries for passport export.');
+    }
+    const rawClaimId = exactText(input.claimId, 80);
+    if (!CLAIM_IDS.has(rawClaimId))
+        throw new TypeError('Select a current Lookup claim to export.');
+    const claimId = rawClaimId;
+    const selected = input.readiness.entries.find((entry) => entry.id === claimId);
+    if (!selected || !CLAIM_STATES.has(selected.state))
+        throw new TypeError('Select a current Lookup claim to export.');
+    if (selected.requirements.length < 1 || selected.requirements.length > MAX_LOOKUP_CLAIM_PASSPORT_REQUIREMENTS) {
+        throw new TypeError('The selected claim has an unsupported evidence-requirement count.');
+    }
+    const type = targetType(input.targetType);
+    const value = targetValue(type, input.target);
+    const generatedAt = timestamp(input.generatedAt) ?? new Date().toISOString();
+    const applicationVersion = exactText(input.applicationVersion, 80);
+    if (!SEMVER_RE.test(applicationVersion))
+        throw new TypeError('A valid application version is required for a claim passport.');
+    const lookupDepth = input.lookupDepth === 'deep' ? 'deep' : input.lookupDepth === 'fast' ? 'fast' : null;
+    if (!lookupDepth)
+        throw new TypeError('A completed Lookup depth is required for a claim passport.');
+    const requirementIds = new Set();
+    const requirements = selected.requirements.map((source) => {
+        const id = requirementId(source.id);
+        if (requirementIds.has(id) || !SOURCE_STATES.has(source.state)) {
+            throw new TypeError('The selected claim contains duplicate or invalid evidence requirements.');
+        }
+        requirementIds.add(id);
+        let evidenceId = null;
+        if (source.evidenceId !== null) {
+            const normalizedEvidenceId = exactText(source.evidenceId, 64);
+            if (!/^[a-z][a-z0-9_-]{0,63}$/u.test(normalizedEvidenceId))
+                throw new TypeError('The selected claim contains an invalid evidence source identifier.');
+            evidenceId = normalizedEvidenceId;
+        }
+        if (source.mode !== 'network_collection' && source.mode !== 'local_review') {
+            throw new TypeError('The selected claim contains an invalid evidence requirement mode.');
+        }
+        return Object.freeze({
+            id,
+            label: exactText(source.label, 160),
+            evidenceId,
+            mode: source.mode,
+            state: source.state,
+            observedAt: evidenceId ? timestamp(input.evidenceObservedAtById?.[evidenceId]) : null,
+            limitations: Object.freeze(uniqueText(source.limitations, 8)),
+        });
+    });
+    if (requirements.some((item) => !item.label))
+        throw new TypeError('The selected claim contains an invalid evidence label.');
+    const requiredEvidenceIds = requirements.map((item) => item.id);
+    const missingEvidenceIds = requirements.filter((item) => item.state !== 'complete').map((item) => item.id);
+    const riskModelVersion = Number.isSafeInteger(input.riskModelVersion)
+        && Number(input.riskModelVersion) >= 1
+        && Number(input.riskModelVersion) <= 1_000
+        ? Number(input.riskModelVersion)
+        : null;
+    const claimLabel = exactText(selected.label, 160);
+    const claimConclusion = exactText(selected.conclusion, 600);
+    const unsigned = {
+        schema: LOOKUP_CLAIM_PASSPORT_SCHEMA,
+        version: LOOKUP_CLAIM_PASSPORT_VERSION,
+        generatedAt,
+        application: { name: 'WHOISleuth', version: applicationVersion },
+        target: { type, value },
+        observation: { observedAt: timestamp(input.observedAt), lookupDepth },
+        claim: {
+            id: claimId,
+            label: claimLabel,
+            state: selected.state,
+            conclusion: claimConclusion,
+            requiredEvidenceIds,
+            missingEvidenceIds,
+            requirements,
+            limitations: uniqueText(selected.limitations),
+        },
+        models: {
+            claimReadiness: LOOKUP_CLAIM_READINESS_VERSION,
+            risk: riskModelVersion,
+        },
+        limitations: uniqueText([
+            input.readiness.limitation,
+            'This portable passport records evidence sufficiency for one point-in-time statement. It does not establish that the statement is true, current, safe, authorized, or attributable to an owner or actor.',
+            'The SHA-256 digest detects changes to this file. It does not authenticate the analyst, collection source, signer, or truth of the retained states.',
+            'Raw registry responses, contacts, page values, request paths, credentials, and browser-local records are excluded.',
+        ]),
+    };
+    if (!unsigned.claim.label || !unsigned.claim.conclusion)
+        throw new TypeError('The selected claim is incomplete.');
+    const digestSha256 = await sha256ArtifactDigestV2(unsigned);
+    const document = Object.freeze({
+        ...unsigned,
+        claim: Object.freeze({
+            ...unsigned.claim,
+            requiredEvidenceIds: Object.freeze(requiredEvidenceIds),
+            missingEvidenceIds: Object.freeze(missingEvidenceIds),
+            requirements: Object.freeze(requirements),
+            limitations: Object.freeze(unsigned.claim.limitations),
+        }),
+        limitations: Object.freeze(unsigned.limitations),
+        integrity: Object.freeze({ algorithm: 'SHA-256', canonicalization: SORTED_JSON_V2, digestSha256 }),
+    });
+    const content = `${JSON.stringify(document, null, 2)}\n`;
+    if (new TextEncoder().encode(content).byteLength > MAX_LOOKUP_CLAIM_PASSPORT_BYTES) {
+        throw new TypeError('The claim passport exceeds its export byte limit.');
+    }
+    const safeTarget = value.toLowerCase().replace(/[^a-z0-9.-]+/gu, '-').replace(/^-|-$/gu, '').slice(0, 100) || 'target';
+    return Object.freeze({
+        document,
+        content,
+        filename: `whoisleuth-claim-${safeTarget}-${claimId}-${generatedAt.slice(0, 10)}.json`,
+    });
+}